312-50 Question 97
Single answer▪ SMTP and DNS EnumerationDuring an authorized external assessment of examplecorp.com, you are asked to identify internal mail hosts and validate whether the organization is exposing user-enumeration weaknesses through SMTP. A standard port scan shows TCP 25 open on mail1.examplecorp.com, but the server banner reveals only a generic Postfix greeting. Zone transfer attempts against the domain's name servers fail. Which action is the MOST appropriate next step to gather useful enumeration data while staying aligned with common CEH methodology?
- A
Query the domain's MX records and then test the SMTP server with VRFY or RCPT TO for selected usernames
- B
Use an SNMP walk against UDP 161 on the mail server because SMTP user accounts are typically exposed through SNMP by default
- C
Attempt an AXFR zone transfer repeatedly against the MX host because mail servers normally also serve authoritative DNS zones
- D
Send crafted emails with malicious attachments to multiple guessed addresses and infer valid users from delivery behavior
Show answer and explanation
Correct answer: A
Explanation
When DNS zone transfer is blocked, a tester should move to narrower DNS enumeration such as MX lookups to identify mail infrastructure. Once mail exchangers are identified, SMTP enumeration can be performed carefully using commands like VRFY, EXPN, or RCPT TO, depending on server configuration. In practice, many modern MTAs such as Postfix commonly disable VRFY to reduce abuse, but RCPT TO behavior may still reveal whether a recipient exists if the server performs recipient validation during the SMTP transaction. This is why combining DNS MX enumeration with SMTP probing is the most effective and realistic next step. This approach aligns with standard operational behavior documented in SMTP-related RFCs such as RFC 5321, which defines SMTP commands including VRFY, EXPN, and RCPT. For DNS, MX records are defined as part of standard DNS mail routing and are a common source of infrastructure discovery when AXFR is unavailable. From a best-practice standpoint, ethical testers should prefer the least disruptive method that meets the engagement objective and avoid unnecessary actions such as phishing or payload delivery when simple protocol enumeration is sufficient.
- A. Correct.
Correct. Querying MX records is a practical DNS enumeration step to identify the organization's mail exchangers when full zone transfer is unavailable. After identifying the mail hosts, testing SMTP commands such as VRFY, EXPN, or RCPT TO can help determine whether the server leaks user-validity information. In real environments, VRFY and EXPN are often disabled, so RCPT TO during a controlled SMTP session is commonly used to observe acceptance or rejection behavior for candidate usernames. This matches standard enumeration workflow used in ethical hacking: DNS first, then service-specific probing.
- B. Incorrect.
Incorrect. SNMP can expose useful host and network information when enabled and misconfigured, but it is not the normal or preferred mechanism for enumerating SMTP users. Many mail servers do not expose mailbox or directory information through SNMP, and assuming this is a default source of SMTP account data is a misconception. It may be worth checking if UDP 161 is open, but it is not the most appropriate next step for SMTP and DNS enumeration in this scenario.
- C. Incorrect.
Incorrect. AXFR zone transfers are attempted against authoritative DNS servers, not against an MX host merely because it handles email. Some systems may have overlapping roles, but that should not be assumed. Repeating AXFR against the MX host is unlikely to provide value unless that host is confirmed to be authoritative for the zone. The scenario already states that zone transfer attempts against the domain's name servers failed, so a better next step is targeted DNS record enumeration and SMTP testing.
- D. Incorrect.
Incorrect. Sending malicious attachments is not an enumeration step and would be inappropriate for this goal. It shifts the activity from passive or low-impact service enumeration into active social engineering and potentially exploit delivery. Even if bounce messages can reveal address validity, using malicious payloads is unnecessary and not aligned with least-impact testing practices for this scenario.